Linux Kernel EUVD-2026-27699

Exploitation requires all of the following: (1) local account access with at minimum low privileges (PR:L per CVSS); (2) the target system must use Intel SOF HDA audio hardware with the snd_sof_intel_hda_common kernel module loaded and active; (3) a mismatch must exist between the DAI links defined in the machine driver and the loaded audio topology - specifically, the playback or capture widget must be NULL, which the commit states occurs especially with loopback/echo reference capture using the dummy DAI link; (4) the user must be able to trigger an audio operation that exercises the affected hda_dai_get_ops code path. Systems with correctly configured and matching audio topologies are not vulnerable regardless of kernel version. The limiting factors are the Intel SOF HDA hardware requirement, the module being loaded, and the pre-existing topology mismatch - making opportunistic exploitation unlikely and targeted exploitation dependent on environment-specific audio configuration knowledge.

CVSS 5.5 with AV:L/AC:L/PR:L reflects local-only exploitation with low privileges and purely availability impact - no confidentiality or integrity exposure. The EPSS score of 0.02% at the 5th percentile strongly corroborates that real-world exploitation is unlikely; this is consistent with the narrow conditions required (specific Intel SOF HDA hardware plus a broken audio topology). No CISA KEV entry exists and no public proof-of-concept has been identified, placing this firmly in the category of a low-exploitation-probability stability bug rather than an actively targeted security flaw. The primary risk is operational: systems with custom or corrupted audio firmware/topology could experience kernel panics, which may be consequential in embedded media or kiosk deployments. The NVD-assigned AC:L may slightly overstate ease of exploitation since a pre-existing topology mismatch is a prerequisite; an independent assessment would favor AC:H. Overall, this is a patch-and-move-on issue for most environments - priority is elevated only for Intel SOF HDA systems running custom audio topologies.

A local user with standard (non-root) privileges on an Intel SOF HDA-equipped Linux system initiates an audio recording operation - such as opening an echo-reference loopback capture device - on a system whose loaded audio topology does not match the machine driver's DAI link table. The kernel executes hda_dai_get_ops with an unset (NULL) widget pointer, panics at offset 0x14 into the function, and the system crashes. No public exploit code exists at time of analysis; triggering this requires either a naturally broken topology or deliberate topology corruption, which itself may require elevated access.